pqscan
About this tool
pqscan is a command-line scanner. It reads one target or a target list. It writes one scan record per target. The record shows the target’s TLS and QUIC configuration. The record also shows the target’s post-quantum readiness rating. The tool composes with the import toolset: target lines in, streaming JSONL out. The 2026.01-rc3 release-candidate cut is live and attested. The written specification is in force.
What the record shows
Each record carries five parts.
- one negotiated key-group, for example X25519MLKEM768
- one cipher suite and one protocol version
- one certificate result: the signature and the key type
- one QUIC result, if the target answers the UDP plane
- one readiness rating: a number from 0 to 100
The machine formats give the record as JSON, CSV or text. The -explain option adds the same facts as plain sentences. The text never adds facts the record does not carry.
What the tool reads
The tool reads simple target forms: a domain, an IP address, a host with a port. It also reads scan results from other tools. Use these commands only.
subfinder -d shain.io -silenthttpx -silent -ports 443,8443 -p 443,8443 -no-colornaabu -l domains.txt -p 443,8443,465,993 -silentnuclei -l hosts.txt -silent -j
These commands are fixed. Other output forms do not parse. The tool reports the error and stops.
Three scan modes
- fast: one handshake. The tool gives the record in milliseconds.
- deep: the probe matrix. The tool sends one probe at a time and records each answer.
- pq: the PQ offer set. The tool sends PQ-only offers. Each refusal carries the server’s reason.
Measured performance
The numbers come from measured runs. The release gate re-runs the rate and the size checks at every cut. Published numbers stay current. The latency model and the budget decomposition: Design.
Start
The release page carries attested static binaries for linux (amd64/arm64) and darwin/arm64. The three lines below install the tool. The full matrix — source installs, checksum and SLSA verification steps, Windows — lives in INSTALL.md.
brew tap shsingh/tap && brew install pqscan # macOS
go install github.com/shsingh/pqscan/cmd/pqscan@2026.01-rc3 # any platform with Go
gh attestation verify pqscan-<os>-<arch> -R shsingh/pqscan # verify before runningInstall the tool, then run the scan. Read the record and the plain sentences under it.
pqscan -u example.com -explainThe sentences show what is safe today and what is not.
Alternative tools
| Tool | Capability in common with pqscan | Divergence from pqscan’s scope |
|---|---|---|
| cryptonice | Multi-surface scan menu (TLS, HTTP, DNS, fingerprint) with structured JSON reporting | Python execution model without the throughput contract; PQC group and signature assessment out of scope |
| gnutls-cli-debug | Exhaustive offer-and-observe protocol and suite probing | Interactive single-target scope; group and signature matrices are not scriptable |
| testssl.sh | Wide protocol coverage including legacy versions, single-file portability | Serial execution model bounds estate-scale runs; PQC codepoints not classified |
| sslyze | Structured TLS probing library; base for several Python scanners | Per-target serial execution; no pipe-first interface |
| zgrab2 | Modular scanner architecture designed for handshake rates at scale | One or few handshakes per host by design; no suite/group enumeration depth |
| masscan / zmap | Rate-disciplined mass port discovery | Port discovery only, by design; composes with pqscan as input |
| TLS-Scanner | Exhaustive protocol analysis | Academic toolchain packaging; not an operations-chain component |
| httpx / nuclei / naabu | Pipe-first dialect: streaming JSONL, silent output, resume, sharding | Scope centred on HTTP content and port enumeration; cipher configuration delegated to pqscan |
| Censys / Shodan | Large-scale PQC observation datasets | Remote datasets only; no on-demand probing of arbitrary target lists |
Port and host discovery compose with the adjacent tools. See Recipes. pqscan covers the cipher-configuration plane: TLS and QUIC handshake parameters, certificates, PQC classification.
Security
Scan only owned or authorised systems. Report findings privately. See Security and SECURITY.md.
Contact
| Author | Shain Singh — shain.singh@owasp.org |
| PGP | 9CB1781DC2BB28D37A0155DCAAF8226F3F4C1712 — public key: github.com/shsingh.gpg |
| Security reports | Private vulnerability reporting / email encrypted to the key above — never a public issue |
| Governance | Governance page · commit-signing verification |